I recommend switching from Deployment Monitor to Splunk on Splunk (S.o.S.). There are no current plans for a new DepMon release. S.o.S. is actively and lovingly maintained/updated by our Support Team. The reporting and monitoring capability in S.o.S. is really top-notch. ... View more

Can you confirm that you can connect to the SQL Server system from the box where you are running dbx? It sounds to me like you're not getting a response from the remote system. The dbx/databases endpoint , as far as I understand it, is waiting on the javabridge to return a connection from the remote system. ... View more

What RDBMS are you trying to connect to? ... View more

have you tried using a subsearch? ... View more

What version of DBX and Splunk are you using? As far as I know, role inheritance works just fine, but just to factor out any inheritance-related issues , can you test with dbx_user assigned directly to the user? ... View more

A heavy forwarder is a full version of Splunk. The thing that makes it a forwarder is turning on forwarding . Have you followed the steps here to turn on forwarding? http://docs.splunk.com/Documentation/Splunk/6.1.1/Forwarding/Deployaheavyforwarder ... View more

Hi maradibs, I'm sorry that you're still having trouble. Data for the Deployment monitor goes to and only goes to the _internal index. If you see the forwarder in the dashboard, there are definitely events for it in the _internal index As mentioned by somesoni, the _internal index is where you will see any errors. Make sure your time range covers an appropriate time range as it is possible that your forwarder was reporting previously but is not longer. If you still don't see any events. Try looking directly at splunk/var/log/splunk/splunkd.log on your forwarder ... View more

Here is the first part of of the all_forwarders search macro definition [forwarder_metrics] definition = index="_internal" source="*metrics.lo*" group=tcpin_connections If you would like to search the same events being used by the deployment monitor, make sure and specify index=_internal in your search. ... View more

lol. nvd3 is d3. These examples show you how to feed Splunk data into the D3 toolkit and visualize it. If you prefer raw js / html, then you can visit examples here: http://dev.splunk.com/view/SP-CAAAEN6 Finally, if you prefer to develop using the older Module system and Advanced XML , check out the HadoopOps app on apps.splunk.com. The HadoopOpsGauge module uses d3. ... View more

Download and install the Web Framework Toolkit App. It has the examples you're looking for. ... View more

warnerd, you can definitely run the *Nix app on Splunk for Windows. As jcoates mentions, install your forwarders and TAs (also referred to as Add-ons) on the remote system. Install the full app on your Splunk Search Head (your Windows 2008R2 machine). ... View more

sure, can you give an example ? ... View more

oh , i'm not sure if this is just a typo in your question, but from what I can see the logfiles directory is CamelCase : System32\LogFiles\ , not System32\logfiles ... View more

are any errors showing up in your _internal index? ... View more